Malicious JScript Spawning Hidden PowerShell Remcos
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create) which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated with a malicious image download and a subsequent Remcos RAT payload.
Sigma
